(,1 2 1/,1( - University of Virginia School of Law · rofecoxib (Vioxx®), a nonsteroidal anti-inflammatory drug, by its manufacturer, Merck & Co., Inc.13 A large study had indicated

Citation: 12 Hous. J. Health L. & Pol'y 93 2011-2012

Content downloaded/printed from HeinOnline (http://heinonline.org)Tue Jul 16 11:58:12 2013

-- Your use of this HeinOnline PDF indicates your acceptance of HeinOnline's Terms and Conditions of the license agreement available at http://heinonline.org/HOL/License

-- The search text of this PDF is generated from uncorrected OCR text.

-- To obtain permission to use this article beyond the scope of your HeinOnline license, please use:

https://www.copyright.com/ccc/basicSearch.do? &operation=go&searchType=0 &lastSearch=simple&all=on&titleOrStdNo=1534-7909

12 Hous. J. Health L. & Policy 93Copyright © 2012 Mark A. Rothstein & Gil SiegalHouston Journal of Health Law & PolicyISSN 1534-7907

HEALTH INFORMATIONTECHNOLOGY AND PHYSICIANS'DUTY TO NOTIFY PATIENTS OF NEWMEDICAL DEVELOPMENTS#Mark A. Rothstein*Gil Siegal'

I. INTRODUCTION

Physicians' duties to their patients traditionally have beenlimited in time and scope to the specific episode of care or clinicalencounter. Physicians generally have had no legal or ethical duty tonotify patients about new, patient-specific medical information orgeneral medical advances discovered after the patient's last episodeof care.1 Because of a perceived undue burden, notification after a

# Some of the issues explored in this article were originally raised in Mark A. Rothstein,Physicians' Duty to Inform Patients of New Medical Discoveries: The Effect of Health InformationTechnology, 39 J.L. MED. & ETHICS 690 (2011). The authors are indebted to the following

individuals for helpful comments on earlier drafts of this article or for general guidance onthis topic: Wylie Burke, Ellen Clayton, Bob Esterhay, Barbara Evans, Heather Harrell, SteveHarrell, Thaddeus Pope, Bill Sage, and Kenny Zegart.

* Herbert F. Boehl Chair of Law and Medicine, Director, Institute for Bioethics Health Policy

and Law, University of Louisville School of Medicine.

+ Professor of Law, University of Virginia School of Law and Chair, Center for Health Lawand Bioethics, Kiryat Ono College, Kiryat Ono, Israel.

See Alasdair G.W. Hunter, Neil Sharpe, Michelle Mullen, & Wendy S. Meschino, Ethical,

Legal, and Practical Concerns About Recontacting Patients to Inform Them of New Information: The

Case in Medical Genetics, 103 AM. J. MED. GENETICS 265 (2001) (reviewing ethical and legaldoctrines in light of genetics); B.E. Calfee, Note, What You Don't Know Will Hurt You:Physicians' Duty to Warn Patients About Newly Discovered Dangers in Previously Initiated

Hous. J. HEALTH L. & POL'Y

clinical encounter has been required only in extraordinarycircumstances, such as to correct erroneously reported test results.2

New developments in health information technology (HIT) havedrastically altered the ratio of benefits to burdens in patientnotification.3 Several types of HIT have the potential to serve asefficient and effective, real-time links between physicians andpatients.4 Based on current and projected developments in HIT, thisarticle proposes that physicians should have a limited duty to notifypatients about certain significant and relevant informationdiscovered after a clinical encounter.5 The duty to notify patientsadvocated in this article is consistent with analogous statutory andcommon law obligations to share or divulge information. It is alsoconsistent with modern principles of medical ethics, whichemphasize shared decision-making by physicians and patients basedon information disclosure. 6

The terms "duty to report," "duty to inform," "duty to warn,""duty to re-contact," and "duty to notify" are often usedinterchangeably in every day parlance, the ethics literature, statutes,and common law.7 For clarity, "duty to report" refers to a reportmade to a governmental or professional body, such as a public healthagency. "Duty to inform" refers to informed consent, where aphysician has a duty to explain in understandable language the

Treatments, 31 CLEV. ST. L. REV. 649 (1982) (discussing possible tort liability for failure to

follow up).

2 See generally Thomas L. Hafemeister & Selina Spinos, Lean on Me: A Physician's Fiduciary

Duty to Disclose an Emergent Medical Risk to the Patient, 86 WASH. U. L. REV. 1167 (2009).

3 Hardeep Singh et al., Reducing Diagnostic Errors Through Effective Communication: Harnessing

the Power ofInformation Technology, 23 J. INTERNAL MED. 489,491-92 (2008).

4 Id. at 493.

5 This article does not specifically consider the legal or ethical obligations of non-physician

health care providers to notify patients of new medical developments, but the analysis

would follow along the same lines as the one used for physicians. The article also does not

consider legal or ethical issues raised by governmental notification of individuals for public

health purposes.

6 See AMERICAN MEDICAL ASSOCIATION, CODE OF MEDICAL ETHICS, 2010-2011 Edition, §

8.08(2010), available at http://www.ama-assn.org/ama/pub/physician-resources/medical-ethics/code-medical-ethics/opinion8082.page.

7 For a discussion of the confusing state of the terminology, see Bartha Maria Knoppers &

Amy Dam, Return of Results: Toward a Lexicon?, 39 J.L. MED. & ETHICS 577, 577 (2011).

MARK A. ROTHSTEIN & GIL SIEGAL 95

patient's diagnosis, prognosis, and treatment options. 8 "Duty to

warn" refers to the duty of a health professional to warn identifiablevictims of serious threats.9 "Duty to re-contact" refers to the

obligation of a researcher to communicate with research subjectsabout after-acquired or incidental research findings.1 0 "Duty tonotify," the primary focus of this article, refers to the duty of aphysician to communicate with and disclose to patients new medicaldevelopments relevant to their ongoing medical care.

Part II of the article presents the medical justification forestablishing a legal and ethical duty to notify patients of new medicaldevelopments. Part III describes and analyzes the HIT that enablespatient notification without undue burden. Part IV traces how the

ethical obligations of physicians to disclose information to patientshave evolved and how a duty to notify is consistent with the ethicalprinciples governing the modern physician-patient relationship. Part

V discusses some recently enacted federal and state statutes requiringphysicians to notify patients about adverse outcomes, includingmedical errors, and breaches of health information security. Part VIanalyzes common law liability for failing to disclose information,including informed consent and the duty to warn intended victims ofthe violent threats of mental health patients. Part VII details keyaspects of the proposed duty, including to whom it is owed, when itarises, and how it is satisfied. Finally, Part VIII concludes byassessing prospects for the adoption and implementation of the dutyto notify patients of new medical developments.

8 For a further discussion, see infra Parts IV-B and VI-A.

9 For a further discussion, see infra Part VI-C.

10 See generally Susan M. Wolf et al., Managing Incidental Findings in Human Subjects Research:

Analysis and Recommendations, 36 J.L. MED. & ETHICS 219 (2008); Ma'n H. Zawati et al.,Incidental Findings in Genomic Research: A Review of International Norms, 9 GENEDIT 1 (2011).The term "re-contact" also has been used to describe the obligation of clinicians to notifypatients about new studies, see, e.g., Reed E. Pyeritz, The Coming Explosion in Genetic Testing- Is There a Duty to Recontact?, 365 NEW ENG. J. MED. 1367, 1367-69 (2011), but this articlerefers to "re-contact" by a clinician as notification.


II. THE MEDICAL BENEFITS OF NOTIFICATION

Medical benefit to the patient is the reason for recognizing a legaland ethical duty on the part of physicians to notify patients of newmedical developments. The existence of the duty proposed in thisarticle depends on the importance of notification to the patient'shealth. This section explores how notification can result in medicalbenefits in three illustrative cases: preventing potentially life-threatening adverse drug reactions, obtaining prompt informationabout medical device recalls, and modifying lifestyle.

A. Preventing Severe Adverse Drug Reactions: TheWithdrawal of Rofecoxib

Since 1993, an average of 1.5 drugs per year have beenwithdrawn for safety reasons in the United States." Although therate of withdrawals has been relatively constant, more recentwithdrawals have involved larger numbers of users.12 The more usersof withdrawn prescription drugs, the more important it becomes toprovide timely and comprehensive patient notification.

In 2004, the Food and Drug Administration (FDA) issued aPublic Health Advisory about the voluntary market withdrawal ofrofecoxib (Vioxx®), a nonsteroidal anti-inflammatory drug, by itsmanufacturer, Merck & Co., Inc.13 A large study had indicated anincreased risk for cardiovascular events in patients taking rofecoxib,especially those who had been taking the drug for longer thaneighteen months.14 At the time of the withdrawal, approximately twomillion people in the United States were taking the drug.15 The

i A.M. Issa et al., Drug Withdrawals in the United States: A Systematic Review of the Evidence and

Analysis of the Trends, 2 CURRENT DRUG SAFETY No. 3, 177, 180 (2007).

12 Id.

13 U.S. FOOD & DRUG ADMIN., FDA Issues Public Health Advisory on Vioxx as its Manufacturer

Voluntarily Withdraws the Product, FDA NEWS RELEASE (Sept. 30, 2004),http://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/2004/ucmlO8361.htm(last updated June 18, 2009).

14 Anil Jain et al., Responding to the Rofecoxib Crisis: A New Model for Notifying Patients at Risk

and Their Health Care Providers, 142 ANNALS INTERNAL MED. 182, 182 (2005); see also U.S.FOOD & DRUG ADMIN., supra note 13.

15 Jain et al., supra note 14; Eric J. Topel, Failing the Public Health - Rofecoxib, Merck, and the

96


withdrawal occurred at the pharmacy level, meaning that newprescriptions for the drug would not be filled, but notification of thepublic was still necessary to urge patients to discontinue taking thedrug immediately. 16 Many people learned of the withdrawal viaprint, broadcast, or electronic media, but some undoubtedly did notlearn of the withdrawal until they attempted to refill theirprescription. The delay in notice placed these individuals at anavoidable risk.

Immediately after the notice of withdrawal, the Cleveland Clinicused its electronic health record (EHR) system to identify all of itspatients with a prescription for rofecoxib, sent standard messages toall of these patients who were utilizing the clinic's Internet-basedshared EHR system, sent an e-mail to all of the clinic's health careproviders, and sent a computer-generated postal mailing to allpatients with a rofecoxib prescription. 17 Within twenty-four hours ofthe withdrawal, notices were sent to 842 prescribing providers and all11,699 patients with a rofecoxib prescription 8 The success of theCleveland Clinic's response to the medication withdrawaldemonstrated the feasibility and desirability of using EHRs and HITto provide important patient information in an expedited manner.19

B. Medical Device Recalls: Silicone Gel Breast Implants

High technology medicine requires the use of numerous medicaldevices, and sometimes the devices fail or prove dangerous.20 The

FDA, 351 NEW ENG. J. MED. 1707 (2004).

16 Jain et al., supra note 14.

17 Id. at 183.

1' Id. at 184.

19 Consumer website updates are also effective in responding rapidly to drug withdrawals.Peter J. Embi et al., Responding Rapidly to FDA Drug Withdrawals: Design and Application of aNew Approach for a Consumer Health Website, 8 J. MED. INTERNET RES. No. 3, e16,doi:10.2196/jmir.8.3.e16 (2006).

20 Each year, over 8,000 new medical devices are marketed in the United States, including 50-80 high-risk, or class III, devices. David W. Feigal et al., Ensuring Safe and Effective MedicalDevices, 348 NEW ENG. J. MED. 191 (2003). Among the many types of devices recalled inrecent years are artificial joints, breast implants, catheters, hemodialysis systems,implantable cardioverter defibrillators, infusion systems, pacemakers, stents, tracheostonytubes, ventilators, and ventricular assist devices. See FOOD & DRUG ADMIN., List of DeviceRecalls, http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/default.htm (last visited


FDA approval process for medical devices involves the following twoalternative mechanisms: (1) premarket approval, which requiresclinical testing and inspections; or (2) the so-called 510(k) clearance ornotification process (named after section 510(k) of the Medical DeviceAmendments of 1976),21 which merely requires that the device be"substantially equivalent" to a device already on the market.22 Thesecond method is intended for low or moderate risk devices,although many critics claim this lower scrutiny process is overused 23

or should be eliminated entirely. 24 According to one study, between2005 and 2009, there were 113 medical device recalls involvingdevices the FDA determined could cause serious health problems ordeath.25 Only twenty-one of the 113 devices had been approvedthrough the more rigorous premarket approval process, eighty werecleared through the 510(k) process, eight were deemed exempt fromFDA regulation, and four were determined to be counterfeit devicesor classified as "other." 26

Medical device recalls are usually conducted voluntarily by themanufacturer. 27 If the manufacturer fails to do so, and the FDA findsthat "there is a reasonable probability that a device ... would causeserious, adverse health consequences or death," it may order the

Sept. 21, 2012).

21 Federal Food, Drug, and Cosmetic Act, Pub. L. No. 94-295, 90 Stat. 539 (1976) (codified as

amended at 21 U.S.C. §§ 301-399a (2006)).

22 21 C.F.R. § 807.92 (2010).

23 See, e.g., Alan M. Garber, Modernizing Device Regulation, 362 NEw ENG. J. MED. 1161 (2010).

For a discussion of the FDA's initiatives to improve the section 510(k) process, see Hearing,

Before the S. Spec. Comm. on Aging, 112th Cong. 1 (April 13, 2011) (statement of William

Maisel, M.D., Deputy Ctr. Dir. for Science, Ctr. for Devices & Radiological Health, FDA),available at http://www.fda.gov/NewsEvents/Testimony/ucm250709.htm.

24 INST. OF MED., Medical Devices and the Public's Health: The FDA 510(k) Clearance Process at 35

Years (2011), available at http://www.iom.edu/Reports/2011/Medical-Devices-and-the-Publics-Health-The-FDA-510k-Clearance-Process-at-35-Years.aspx.

25 Diana M. Zuckerman et al., Medical Device Recalls and the FDA Approval Process, 171

ARCHIVES INTERNAL MED. 1006 (2011).

26 Id.

27 U.S. FOOD & DRUG ADMIN., Postmarket Requirements (Devices),

http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/PostmarketRequireme

nts/ (last visited Oct. 17, 2011). See 21 C.F.R. § 7.40 (2010).

MARK A. ROTHSTEIN & GIL SIEGAL

cessation of distribution or use of the device.28 These orders,however, are rarely issued.29 When a high risk medical device isrecalled, the following three strategies are used to notify the public:(1) the FDA lists all recalls, withdrawals, and alerts on its website;30

(2) the manufacturer is required to notify vendors, physicians, andhospitals of the recall, withdrawal, or alert; and (3) physicians andhospitals are responsible for notifying their patients.31

If the FDA finds that a device "presents an unreasonable risk ofsubstantial harm to the public health," that notification is "necessaryto eliminate" this risk, and that "no more practicable means isavailable" to eliminate the risk, it may order manufacturers or healthcare providers to notify device users of the risk.32 This authority hasbeen used quite rarely.33 Because there is generally no legalobligation for the manufacturer to notify patients directly, sometimespatients receive untimely notification or none at all.34 The FDAAmendments Act of 2007 established an Internet-based system fordisseminating risk information to patients and providers.35 Thesystem allows for the accumulation of data from labeling, package

28 Federal Food, Drug, and Cosmetic Act, 21 U.S.C. § 360h(e)(1) (2006).

29 U.S. FOOD & DRUG ADMIN., FDA 101: Product Recalls -From First Alert to Effectiveness Checks

(May 2010), available athttp://www.fda.gov/ForConsumers/ConsumerUpdates/un049070.htni.

30 See id. Each month there are over 300,000 visits to the FDA consumer information sectionsof the website. See U.S. FOOD & DRUG ADMIN., Consumer Update Analytics,

http://www.fda.gov/ForConsumers/ConsumerUpdates/ucm2l5588.htm (last visited Sept.21, 2012)..

31 U.S. FOOD & DRUG ADMIN, What Happens in a Medical Device Recall?,

http://www.fda.gov/MedicalDevices/Safety/RecallsCorrectionsRemovals/ucm243982.htm(last visited Feb. 25, 2011).

32 21 U.S.C. § 360h(a) (2006).

33 It was used only once in 2010. INST. OF MED., supra note 24, at 58.34 See, e.g., JoNel Aleccia, Torn Corneas, Vision Problems Follow "Stealth Recall" of Contact Lenses,

VITALS ON MSNBC.COM (Oct. 11, 2011, 8:42 AM), http://vitals.msnbc.msn.com/_news/

2011/10/11/8259138-tom-comeas-vision-problems-follow-stealth-recall-of-contact-lenses;Susan Hogan, Patients Left in Dark after Medical Recall: Thousands of Patients Affected,WPRI.coM EYEWITNESS NEWS (Nov. 12, 2009, 10:42 PM), http://www.wpri.com/dpp/target_-12/medical-device-hernia-recall-patients-not-told-.

35 Food and Drug Administration Amendments Act of 2007, Pub L. No. 110-85, § 915(1)-(2),121 Stat. 823, 957 (2007).


inserts, medication guides, and safety alerts.36 It does not includepatient notification.37 Methods to notify patients more efficientlyusing HIT hold promise for preventing injuries and deaths fromdangerous medical devices. 38

One of the best known medical device recalls occurred in 1992,when the FDA, responding to reports that some breast implantsleaked and caused serious illness, announced a voluntarymoratorium on silicone gel-filled breast implants.39 The FDArequested that manufacturers stop supplying them and surgeons stopimplanting them while the FDA reviewed studies on implant safety.40

The ban did not apply to reconstruction or revision surgery.41 Themoratorium continued until 2006, when the FDA approved siliconegel-filled breast implants sold by Allergan and Johnson & Johnson'sMentor unit on the condition that both companies follow 40,000women for ten years to look at safety issues.42 The FDA indicated thata 65% enrollment rate was needed but, as of 2011, Allergan's two-year participation rate has been only 60% and Mentor's three-yearrate has been only 21%. 43 In 2011, the FDA announced it wasconsidering establishing a registry of all breast implant recipients to

36 Id.

37 Id.

38 Because most lawsuits involving harms caused by medical devices have involved products

liability actions against the manufacturers, there is little case law on the legal responsibilityof physicians to provide notice. This may be changing, however, in light of the SupremeCourt's holding in Riegel v. Medtronic, Inc., 552 U.S. 312 (2008), that FDA approval of amedical device operates to preempt common law tort actions for products liability. It is notclear whether physicians will be liable for failing to provide notice of recalled medicaldevices to their patients. Compare Tresemer v. Barke, 150 Cal. Rptr. 384 (Cal. Ct. App. 1978)(holding physician had duty to contact patient when IUD recalled three years later), withDoyle v. Planned Parenthood, 639 P.2d 240 (Wash. Ct. App. 1982) (holding physician hadno duty to warn patient of recalled IUD because episode of care had expired years earlier).

39 U.S. FOOD &DRUG ADMIN., Regulatory History of Breast Implants in the U.S.,http://www.fda.gov/MedicalDevices/ProductsandMedical

Procedures/ImplantsandProsthetics (last visited Oct. 17, 2011).

40 Id.

41 Id.

42 Anna Yukhananov, FDA Eyes Registry for Breast Implants Problems, NRC (Aug. 31, 2011),http://www.center4research.org/2011/09/fda-eyes-registry-for-breast-implants-problems,

43 Id.


track adverse events.44 Although there has been no mention of a morerobust patient notification program, HIT could provide promptnotice of medical device recalls to patients, such as women withdefective silicone-gel breast implants. Unfortunately, the importanceof notifying women about defective silicone gel breast implants hasbeen underscored by the 2011 recall of implants manufactured by theFrench company PIP.45

C. Lifestyle Modification: Diverticular Disease and Diet

Until quite recently, physicians have generally recommendedthat patients with diverticular disease of the colon 46 avoid eatingnuts, seeds, corn, popcorn, and certain fruits (e.g., blueberries,strawberries) because they were thought to cause colonic irritationand aggravate diverticular disease.47 The recommendation was basedon the reasonable assumption that, among other things, food withpoorly digested particles could abrade the mucosa or lodge in smalldiverticula and cause inflammation, bleeding, and othercomplications. 48 Despite being .based on seemingly good reasoning,there was no empirical evidence to support the recommendation. In2008, a study appeared in the Journal of the American MedicalAssociation that presented compelling evidence on the relationshipbetween diet and diverticular disease.49 An eighteen-year study of

44 Id.

45 See Atika Shubert, UK Breast Implant Victims Want Answers, CNN (Jan, 7, 2012, 2:42 AM),www.cnn.com/2012/01/07/world/europe/uk-breast-implant/index.html (discussing recallresponses in European countries).

46 Diverticular disease is caused by diverticula, "saclike mucosal outpouchings that protrudefrom a tubular structure .... Colonic diverticula "cause symptoms by trapping feces andbecoming inflamed or infected, bleeding, or rupturing." THE MERCK MANUAL OF DIAGNOSIS&THERAPY ch. 20 (19th ed. 2011). The term includes the less severe diverticulosis, "thepresence of multiple diverticula in the colon," as well as the more severe diverticulitis, an"inflammation of a diverticulum, which can result in phlegmon of the bowel wall,perforation, fistula, or abscess." Id.

47 Lisa L. Strate et al., Nut, Corn, and Popcorn Consumption and the Incidence of Diverticular

Disease, 300 JAMA 907, 907 (2008). See Danny 0. Jacobs, Clinical Practice: Diverticulitis, 357NEW ENG. J. MED. 2057, 2064 (2007); see also S. Schechter et al., Management of UncomplicatedAcute Diverticulitis: Results of a Survey, 42 DISEASES OF COLON & RECTUM 470, 472 (1999).

48 Schechter et al., supra note 47, at 2057.

49 Strate, supra note 47 at 911-12.


47,228 male health professionals showed no correlation betweenconsumption of these foods and increased symptoms of diverticulardisease. 50 In fact, for unknown reasons, the foods exhibited a mildprotective effect.51

Almost immediately, many (although not all) gastroenterologistsand internists prospectively revised the dietary recommendation theygave to their patients with diverticular disease. It is not clear,however, whether or how many physicians made efforts to contactpatients and former patients to update the earlier dietaryrecommendations. Undoubtedly, many thousands of patients havecontinued to be deprived of, among other things, popcorn at movies,chocolate bars with almonds, and a popular fast food doublecheeseburger served on a sesame seed bun. Although the restricteddiet might actually be beneficial to their health for other reasons,many patients undoubtedly would welcome the option to restorecertain previously excluded foods to their diet.

One might be tempted to dismiss this example as involving onlya minor lifestyle choice. Nevertheless, restricted ingredients mayprovide some protective effect or, in the case of nuts, serve as asource of protein and therefore could have a nutritional benefit.5 2 Inaddition, for many individuals, these dietary restrictions, perhapswhen added to other restrictions for medical or nonmedical reasons,might have a significant effect on their quality of life. Furthermore,in other situations new dietary recommendations, rather thanpermitting consumption of previously banned foods, might warnpatients to avoid certain foods to prevent severe adverse effects. Insuch a case, a change in diet becomes an important medicalintervention and not merely a matter of personal choice or lifestyle.Other lifestyle factors with potentially serious health implicationsinclude consumption of alcohol or other substances, exposure toextreme environments, physical exertion, and sexual activity.

5o Id.

51 Id. at 909.

52 Strate et al., supra note 47, at 907-08.


III. THE ROLE OF HEALTH INFORMATION TECHNOLOGY

The proposal in this article is based on the desirability ofconveying actionable information to patients. The development andcontinuous progress of the computing and communication sciencesand new applications provide a wide range of relevant tools toachieve this end. These include Internet (e-health), social networks,cellular phone communication availability (m-health), electronichealth records (EHRs), decision-support systems, and medicaldatabases. The possibilities and spin-offs of HIT in health care arevirtually endless and constantly evolving. Legislative enactments,such as the American Recovery and Reinvestment Act (whichincluded the Health Information Technology for Economic andClinical Health (HITECH) Act), are intended to encourage a broaderadoption and utilization of HIT in health care.53

Three lines of communication with patients are especiallyrelevant to the proposal in this article. First, EHRs allow 24/7 accessto and sharing of patients' medical history, medication plan, andimaging studies. Some countries' health systems have reached anear-complete transformation to digital information systems,54

whereas others (notably the United States) have lagged behind.55

Data mining of EHRs through computing algorithms provides aneasy way of identifying individuals who stand to benefit from newinformation about their medical past, present, or future.56

53 Frederick Turner, Use HITECH as Directed, 32 HEALTH MGMT. TECH. 24, 24 (2011). Seegenerally Health Information Technology for Economic and Clinical Health (HITECH) Act[hereinafter, "HITECH Act"]Provisions of the American Recovery and Reinvestment Act of2009, Medicare and Medicaid Electronic Health Records (EHR) Incentive Programs, andOverview ERH Incentive Programs. See CMS.GOv, https://www.cms.gov/ehrincentiveprograms (last visted Feb. 24, 2012).

54 See, e.g., WHO, Belize Health Information Goes Digital, 87 BULLETINOF THE WHO NO. 2 81, 87-88 (Feb. 2009) available at http://www.who.int/bulletin/volumes/87/2/09-020209.pdf

ss See Eric Jamoom et al., Physician Adoption of Electronic Health Record Systems: United States,

2011, NCHS DATA BRIEF No. 98 (July 2012), available at www.cdc.gov/nchs/data/databriefs/db98.pdf, (reporting that 55% of physicians were using an EHR); INST. OF MED., HEALTH ITAND PATIENT SAFETY: BUILDING SAFER SYSTEMS FOR BETTER CARE 18 (2011); DavidBlumenthal, Wiring the Health System -Origins and Provisions of a New Federal Paradigm, 365NEW ENG. J. MED. 2323 (2011); HITECH Act, supra note 53 (describing the new voluntaryMedicare EHR Incentive Program Congress has passed to address the United States' EHRdeficiencies).

Naren Ramakrishnan et al., Mining Electronic Health Records, 43 COMPUTER 95, 99 (2010).


Second, social networks are proving to be highly effective indisseminating information on a large scale.5 7 Providers can use thistechnology to create patient groups (based on common grounds suchas diagnosis or affiliation with a specific provider), whereinformation exchange is feasible without the need for manyresources. Two main objections can be identified. First, Internetliteracy and accessibility varies widely, and not all patients arecomputer savvy.58 The "digital divide" mostly affects elderly,minority, and low-income populations, thereby raising concernsabout increasing health disparities.59 These concerns should dissipatein the long run with more universal access to computers.60 In theshort run, however, efforts are needed to provide notificationthrough other reliable and secure means. The second objectionpertains to the need for stringent security to prevent third partiesfrom accessing personal information available in social networks. 61

This latter concern can be resolved via coded or anonymousidentifies, or by designing rules for proper use of social medicalnetworks.62 The willingness of individuals to share their personalhealth information is remarkable, and it can be harnessed for thebenefit of many others, notwithstanding privacy and securityconcerns. 63

Finally, mobile health (m-health) is amplifying HIT potency with

57 Nicolas P. Terry, Physicians and Patients Who "Friend" or "Tweet": Constructing a LegalFramework for Social Networking in a Highly Regulated Domain, 43 IND. L. REV. 285, 286-89,292-93 (2010).

58 Mollyann Brodie et al., Health Information, the Internet, and the Digital Divide, 19 HEALTH

AFFAIRS 255,257-59 (2000).

59 See id.; Betty L. Chang et al., Bridging the Digital Divide: Reaching Vulnerable Populations, 11 J.AM. MED. INFORMATICS ASS'N 448,449 (2004).

60 But see Brodie et al., supra note 58, at 263 (questioning whether all social groups will attain

more universal access to computers and thus whether access disparities and usage will

decrease).

61 See Terry, supra note 57, at 285, 294-97.

62 See generally id.

63 Mark A. Rothstein, Health Privacy and the Facebook Generation, BIOETHICS FORUM (Aug. 11,

2011), http://www.thehastirigscenter.orgBioethicsForum/post.aspx?id=3794; Tom Ferguson,E-Patients-How They Can Help Us Heal Healthcare, E-PATIENTS.NET (Mar. 2007), http:f/e-patients.net/e-PatientsWhite Paper.pdf (last visited Feb. 24, 2012); Terry, supra note 57, at321-29.


the addition of mobile capacities. 64 Although HIT availability is stillrestricted in some geographic areas or in some subgroups of society,cellular services are widely available.65 Several high-tech companiesare engaged in software solutions to turn mobile phones intoinformation portals ("smartphone-like"), allowing access to theInternet, social networks, and other electronic platforms.66 Asenvisioned by the International Telecommunication Union (theleading United Nations agency for information and communicationtechnology issues):

With mobile communication, populations can be treated in their homesand communities with access to expert care. Any healthcare personnelcan get access to vital information anywhere and at any time. Wirelesstechnologies increase real time access to accurate patient data,including clinical histories, treatment, medication, tests, laboratoryresults, etc. and result in overall improvement of patient care and theprovision of personalized health services. Mobile technologies can alsoimprove data accuracy and significantly reduce errors during datacollection and disease surveillance. Mobile clinics and mobile portablee-Health terminals can take healthcare to distant locations to supportprompt medical assistance at remote sites or during emergencyresponses.

67

It would be a small step to communicate health-relatedinformation to large groups of patients via mass text messages orautomated voice messages.

Once the technology is in place, numerous questions will stillremain, including what, when, how, and by whom healthinformation should be distributed. Professional bodies (by codes of

64 See generally Naveen Menon et al., Asia Pacific Mobile Observatory 2011, Global Sys. for

Mobile Commc'n Ass'n (GSMA), www.gsma.com/go/download/?file=amoeswebfinal.pdf

(last visited Feb. 24, 2012); see also Vital Wave Consulting, mHealth for Development: The

Opportunity of Mobile Technology for Healthcare in the Developing World at 9, UN Foundation-

Vodafone Foundation Partnership (2009) (describing the increase of mobile device usage in

developing countries and mobile devices' greater potential as HIT tools).

65 Vital Wave Consulting, supra note 64, at 7 (estimating by 2012 half of all people living in"remote areas of the world" will have mobile phones).

66 Joshua J. Romero, Top 11 Technologies of the Decade: No. I Smartphones: Is Your Phone Smarter

than a Fifth Grader?, IEEE SPECTRUM 28, 28-31 (Jan. 2011),

available at http://spectrum.ieee.org/telecom/wireless/smartphones-the-pocketable-pc.

67 INT'L TELECOMM. UNION, Applications and Cybersecurity (CYB): Mobile e-Health, ITU.INT,

http://www.itu.int1TU-D/cyb/app/e-health/mhealth.htrnl (last visited Feb. 24, 2012) (citing

INT'L TELECOMM. UNION, MOILE E-HEALTH SOLUTIONS FOR DEVELOPING COUNTRIES (2010)).


ethics, clinical guidelines, and position statements), governmentalauthorities (by laws, regulations, and disciplinary measures), andlitigation all will play a role in shaping notification policy and law.

IV. ETHICAL PRINCIPLES RELATED TO THE DUTY TONOTIFY PATIENTS

Sections II and III indicated that notifying patients of newmedical discoveries is often medically necessary and technologicallyfeasible. This section demonstrates that an ethical duty on the part ofphysicians to notify patients is consistent with and compelled bymodern conceptions of the physician-patient relationship asevidenced by several ethical principles addressing the disclosure ofinformation and shared decision-making.

A. Veracity or Truth Telling

The history of medical practice is one of largely unchallengedpaternalism, including a reluctance to share information withpatients:

At least since Hippocratic days, patients have been asked to trust theirphysicians without question. But only in recent years have doctorsbeen asked to trust patients by conversing with them about medicaloptions and soliciting their views on how to proceed.68

In 1961, 90% of physicians surveyed indicated that they avoideddisclosing a diagnosis of cancer to their patients.69 By 1979, 98% ofphysicians surveyed said they disclosed a diagnosis of cancer to theirpatients.70 What accounts for such a dramatic shift in such a relativelyshort period of time?

Beginning in the 1960s and continuing through the 1970s, asubstantial social upheaval took place in the United States.71 The civil

68 JAY KATZ, THE SILENT WORLD OF DOCTOR AND PATIENT, xli (rev. ed. 2002).

69 Donald Oken, What to Tell Cancer Patients: A Study of Medical Attitudes, 175 JAMA 1120, 1120

(1961).

70 Dennis H. Novack et al., Changes in Physicians' Attitudes Toward Telling the Cancer Patient,241 JAMA 897, 898 (1979).

71 PAUL STARR, THE SOCIAL TRANSFORMATION OF AMERICAN MEDICINE, 388-89 (1982).

MARK A. ROTHSTEIN & GIL SIEGAL 1UI

rights movement, the anti-war movement, the women's rightsmovement, and other social forces challenged the status quo inrelationships between individuals and social institutions.72 Medicineand health care also reflected these new societal values. Medicareand Medicaid expanded access to health care to individuals whowere elderly, low income, or disabled.73 The field of bioethics arose,prompted by legal developments and changing public attitudestoward medical care at the end of life, reproductive freedom, andresearch ethics.74 Activists argued in favor of rights in health care aswell as a right to health care:75

The new health rights movements were also concerned with rights inhealth care, such as the right to informed consent, the right to refusetreatment, the right to see one's own medical records, the right toparticipate in therapeutic decisions, and the right to due process in anyproceeding for involuntary commitment to a mental institution.76

The days of the tight-lipped, directive physician and the docile,compliant patient were largely over. More educated, informed, andassertive patients demanded to know the details of their health, andphysicians quickly acknowledged it was their professionalresponsibility to supply truthful and complete information. Truthtelling, or veracity, joined the virtues of candor and honesty as coreprofessional values and character traits. 77

The sharing of information was not always complete, however.One category, exempt from disclosure obligations, lasted for decades.The "therapeutic privilege" permitted physicians to withholdinformation deemed likely to cause such distress to the patient that it

72 See generally id.

73 Richard G. Frank, The Creation of Medicare and Medicaid: The Emergence of Insurance andMarkets for Mental Health Services, 51 PSYCHIATRIC SERVS. 465,465 (2000).

74 See generally Mark A. Rothstein, The Role of Law in the Development of American Bioethics, 20INT"LJ. BIOETHICS 73 (2010) (discussing events that led to the development of bioethics in the1970s).

75 See STARR, supra note 71, at 389.

76 Id.

77 TOM L. BEAUCHAMP & JAMES F. CHILDRESS, PRINCIPLES OF BIOMEDICAL ETHICS 288 (6th ed.2009).


would undermine the patient's physical or emotional health.78

Although it is easy to discern a beneficent basis for the exception, thetherapeutic privilege was not clearly limited and it undermined theconcepts of autonomy and respect for persons that gave rise to theprinciple of veracity in the first place.79 In 2006, with an amendmentto its Code of Medical Ethics, the American Medical Association (AMA)ended its support for the therapeutic privilege.80 Thus, the duty tosupply patients (or those responsible for their care) with truthful andcomplete information about a patient's medical condition is now anabsolute ethical precept, at least in the United States.81

B. Informed Consent

The doctrine of informed consent in clinical settings has twomain elements. First, the physician discloses relevant healthinformation to the patient.82 Second, the patient manifests informedconsent or refusal to a treatment plan, procedure, or therapy.83 Asdiscussed in the previous section, the longstanding, accepted medicalpractice was not to disclose all medical information to patients.84

"The informational part of what we call today 'informed consent'

78 See AM. MED. ASS'N, supra note 6, at § 8.082 (adopted 2006, and announcing its intent to no

longer support such a privilege's exemption from disclosure obligations).

79 See generally Nathan A. Bostick et al., Report of the American Medical Association Council onEthical and Judicial Affairs: Withholding Information from Patients: Rethinking the Propriety of"Therapeutic Privilege", 17 J. CLIN. ETHICS 302 (2006).

8o AM. MED. ASS'N, supra note 6, at 8.082:

Section 8.082 Withholding Information from Patients:

The practice of withholding pertinent medical information from patients in thebelief that disclosure is medically contraindicated is known as "therapeuticprivilege." It creates a conflict between the physician's obligation to promote

patients' welfare and respect for their autonomy by communicating truthfully...Withholding medical information from patients without their knowledge orconsent is ethically unacceptable. Id.

81 E.g., Israel Patient Rights Act, 1996, § 13(D) (a healthcare provider may withhold

information if such information will create "severe" physical or mental harm).

82 See 45 C.F.R. § 46.116 (2005).

83 See id.; AM. MED. ASS'N, supra note 6, at § 8.08.

84 See, e.g., Oken, supra note 69, at 1120.


was, it appears, 'up to the doctor."' 85

Although tort law applications of nascent elements of informedconsent began to emerge in the early part of the twentieth century,86

medical ethics did not begin to embrace informed consent until thelate 1950s and early 1960s.87 Again, legal developments, bothcommon law and statutory, led the way:

The standards and the essential elements of informed consent werestated in legal fashion and incorporated into the statutory law of manystates: physicians must inform their patients about the nature of theircondition and its expected course, about the benefits and risks of anyproposed treatment... or non-treatment. This new legal requirementwas impressed upon physicians as a professional duty.88

As with veracity, once a professional consensus developedfavoring informed consent, it soon swept the medical profession.What many legal scholars consider the landmark informed consentcase was not decided until 1972,89 and by 1982, a survey of physicianssuggested that informed consent had become routine, at least forinvasive procedures:90

Almost all of the physicians surveyed indicated they obtained eitherwritten consent (over 80%) or both written and oral consent (about 15%)from their patients before inpatient surgery or the administration ofgeneral anesthesia.... At least 85% [of physicians] said they usuallyobtain[ed informed consent]... for minor office surgery, setting of

85 ALBERT R. JONSEN, THE BIRTH OF BIOETHICS 354 (1998).

s6 RUTH R. FADEN & TOM L. BEAUCHAMi', A HISTORY AND THEORY OF INFORMED CONSENT 119-

120 (1986). For a further discussion of the legal doctrine of informed consent, see infra PartVI-A.

87 Id. at 86. The post-World War II period also was an important time for the development ofinformed consent to research, as the Nuremberg Code recognized informed consent as thefirst principle of ethical research. The issue of informed consent in the research context,however, is beyond the scope of this article.

88 JONSEN, supra note 85, at 355. See generally Jaime S. King & Benjamin W. Moulton, RethinkingInformed Consent: The Case for Shared Medical Decision-Making, 32 AM. J. L. & MED. 429 (2006);Sheldon F. Kurtz, The Law of Informed Consent: From "Doctor Is Right" to "Patient Has Rights,"50 SYRACUSE L. REV. 1243, 1252 (2000); Annette M. 0' Connor et al., Toward the "TippingPoint": Decision Aids and Informed Patient Choice, 26 HEALTH AFFAIRS 716, 723 (2007).

89 Canterbury v. Spence, 464 F.2d 772 (D.C. Cir. 1972). See Marjorie M. Shultz, From InformedConsent to Patient Choice: A New Protected Interest, 95 YALE L. J. 219, 237 (1985).

9o FADEN & BEAUCHAMP, supra note 86, at 98-99.


fractures, local anesthesia, invasive diagnostic procedures, andradiation therapy. [Although] blood tests and prescriptions appear toproceed... without patient consent, ... even here about half of thephysicians reported obtaining oral consent.91

The requirement of informed consent has become an importantelement of the codes of medical ethics of both the American MedicalAssociation and numerous medical specialty colleges and societies. 92

The AMA's code of ethics also addresses other issues raised by thebroad principle of informed consent, including determiningcompetency to consent, consent in emergencies, and consent ofminors.93 All of these variations build on a central, now unassailableprinciple that the physician's role is to explain the medical facts andassist patients in reaching informed healthcare decisions consistentwith their own values and interests.

As the doctrine has been developed and applied, informedconsent has become increasingly complicated. The facts to bedisclosed to the patient include the diagnosis, nature and purpose oftreatment, risks and outcomes, disclosure of the physician's skill orstatus risks (e.g., health), alternatives, prognosis if treatment isdeclined, prognosis with treatment, and any conflicts of interest.94

Among the reasons why there has been an ongoing critique of thedoctrine of informed consent are the complexity of the information tobe disclosed, the pro forma nature of many written and oral

91 Id.

92 AM. MED. ASS'N, supra note 6, at 8.08:

8.08 Informed Consent:

The patient's right of self-decision can be effectively exercised only if the patient

possesses enough information to enable an informed choice. The patient shouldmake his or her determination about treatment. The physician's obligation is topresent the medical facts accurately to the patient or to the individual responsiblefor the patient's care and to make recommendations for management inaccordance with good medical practice. Id.;

see also See BARUCH A. BRODY, MARK A. ROTHSTEIN, LAURENCE B. MCCULLOUGH, & MARY

ANNE BOBINSKI, MEDICAL ETHICS: ANALYSIS OF THE ISSUES RAISED BY THE CODES, OPINIONS,

AND STATEMENTS 425-66 (2001) (reviewing informed consent provisions of leading medical

associations, societies, and colleges).

93 See AM. MED. ASS'N, supra note 6.

94 BARRY R. FURROW ET AL., HEALTH LAW 270-279 (2000); FADEN & BEAUCHAMP, supra note 86,

at 30-32.


disclosures by physicians or other health care providers, the inabilityof a substantial number of patients to comprehend the information,the reluctance of some patients to ask questions, and concerns aboutwhether patients actually want the responsibility to make difficulthealth care decisions.95 Nevertheless, virtually no one is suggesting areturn to the age of silent paternalism. According to Jay Katz, " Itihelegal vision of informed consent, based on self-determination, is stilllargely a mirage. Yet a mirage, since it not only deceives but can alsosustain hope, is better than no vision at all."96

C. Patient Information

Section 8.12 of the American Medical Association's Code ofMedical Ethics seems to have direct relevance to a physician's duty tonotify patients of new medical developments. It reads in part:"Ethical responsibility includes informing patients of changes in theirdiagnosis resulting from retrospective review of test results or anyother information." 97 This provision and other parts of the section are

95 See, e.g., Jay Katz, Informed Consent -- Must It Remain a Fairy Tale?, 10 J. CONTEMP. HEALTH L.& POL'Y 69, 74 (1994); William M. Sage, Regulating Through Information: Disclosure Laws andAmerican Health Care, 99 COLUM. L. REV. 1701, 1721 (1999); Carl E. Schneider, Bioethics with aHuman Face, 69 IND. L.J. 1075, 1094 (1994); Peter H. Schuck, Rethinking Informed Consent, 103YALE L.J. 899, 921 (1994); Gil Siegal, Richard J. Bonnie, & Paul S. Appelbaum, PersonalizedDisclosure by Information-on-Demand: Attending Patients' Needs in the Informed Consent Process40 J. LAW MED. & Ethics 359 (2012).

96 KATZ, THE SILENT WORLD OF DOCTOR AND PATIENT supra note 68, at 84 (italics in original).

97 AM. MED. ASS'N, supra note 6, at 8.12:

8.12 Patient Information

It is a fundamental ethical requirement that a physician should at all times dealhonestly and openly with patients. Patients have a right to know their past andpresent medical status and to be free of any mistaken beliefs concerning theirconditions. Situations occasionally occur in which the patient suffers significantmedical complications that may have resulted from the physician's mistake orjudgment. In these situations, the physician is ethically required to inform thepatient of all the facts necessary to ensure understanding of what has occurred.Only through full disclosure is a patient able to make informed decisionsregarding future medical care.

Ethical responsibility includes informing patients of changes in their diagnosesresulting from retrospective review of test results or any other information. Thisobligation holds even though the patient's medical treatment or therapeuticoptions may not be altered by the new information.

112 Hous. J. HEALTH L. & POL'Y

broad enough to incorporate the duty to notify patients about newmedical developments, but they have never been construed to doSO. 98

The section was intended to discourage physicians from failingto disclose a patient's complete medical information, includingpossible mistakes, based on a concern for legal liability.99 It is notclear the extent to which the section also seeks to establish additionaldisclosure obligations. There is no reason to suspect that such anapplication was even considered, let alone intended, by the draftersof this section of the code. Indeed, all of the literature references tothis section of the code address the issue of medical malpractice. 100

Regardless of the specific intent of this section of the code, itgenerally supports the obligation of physicians to apprise patients ofall relevant medical information, including information discoveredafter the episode of care.101 It is additional support for the propositionthat even if a duty to notify patients is considered a new obligation,such an obligation is consistent with established principles of medicalethics.

D. Non-abandonment

A fundamental element of the physician-patient relationship isthat "[t]he patient has the right to continuity of health care." 102

Continuity of care refers to coordination of care among members of ahealth care team, including not having a physician withdraw from acase without giving sufficient notice to the patient or caregivers sothat another physician may be secured. 103

Concern regarding legal liability which might result following truthful disclosureshould not affect the physician's honesty with the patient. Id.

98 See e.g., AM. MED. ASS'N, supra note 6, at § 8.08.99 John D. Banja, Does Medical Error Disclosure Violate the Medical Malpractice Insurance

Cooperation Clause?, in 3 ADVANCES IN PATIENT SAFETY: FROM RESEARCH TO IMPLEMENTATION371,372 (Kerm Hendriksen et al. eds., 2005), available at http://www.ahrq.gov/downloads/pub/advances/vol3/Banja.pdf.

loo See e.g., AM. MED. ASS'N, supra note 6, at § 8.12..

ol Id. at 280.

i52 Id., § 10.01(5) Fundamental Elements of the Physician-Patient Relationship, at 367.

103 Id., § 8.115 Termination of Physician-Patient Relationship, at 278. See Allan S. Detsky, What


Continuity of care also refers to professional obligations overtime within the context of an ongoing physician-patient relationship:

The obligation of non-abandonment emphasizes the longitudinalnature of a caring and problem-solving commitment betweenphysician and patient. Ethical analyses of clinical actions sometimesfocus on one moment in time and seek generalizable rules or answers,but patients and their physicians do not have the luxury of existing insuch isolation. Clinical decisions involve a series of choices over time,and the consequences of one decision may immediately lead to newchoices.

104

The ethical obligation of physicians rejects the "one moment intime" approach to physician-patient relationships. 105 When there is achange in circumstances, either because of the health status of thepatient or the state of the art in medicine, continuity of care and non-abandonment require that the physician share the new informationwith the patient so they can work collaboratively in developing anew patient-centered treatment plan.106

E. Fiduciary Loyalty

The ethical principles discussed thus far include a physician'sduty to tell patients the truth, to obtain informed consent, to providerelevant information to patients, and to ensure continuity of care.Overarching all of these - and many other - professional obligationsis the physician's duty of loyalty. "The relationship between patientand physician is based on trust and gives rise to physicians' ethicalobligations to place patients' welfare above their own self-interestand above obligations to other groups, and to advocate for theirpatients' welfare."' 07

The physician-patient relationship is one of several legally

Patients Really Want from Health Care, 306 JAMA 2500, 2500 (2011) (mentioning importance topatients of continuity, choice, and coordination of care).

104 Timothy E. Quill & Christine K. Cassel, Nonabandonment: A Central Obligation for Physicians,122 ANNALS INTERNAL MED. 368, 370 (1995).

15 Id. at 370.

106 Id. at 371.

107 AM. MED. ASS'N, supra note 6, at § 10.015 (The Patient-Physician Relationship).


recognized fiduciary relationships. 108 All fiduciary relationships arecharacterized by the fiduciary having special knowledge and theother party reasonably expecting the fiduciary to act in the bestinterests of the individual.109 Fiduciaries have a duty to discloseinformation relevant to fulfilling their fiduciary duties. 10 In thephysician-patient context, the fiduciary duty means more thannonmaleficence; it establishes that the physician has an affirmativeobligation to act for the benefit of the patient, including the duty todisclose information relevant to the patient's health."' The duty alsohas been held to extend beyond the discrete episode of care, evenbeyond the termination of the physician-patient relationship:

It is also worth noting that a physician's fiduciary duty to discloseemergent adverse medical risks 1 2 may extend beyond the terminationof the physician-patient relationship. Courts have recognized that thetiming of the emergent adverse medical condition does not mitigatethe duty to disclose when the physician learns of informationindicating that the patient's medical well-being is at significant risk.113

It can be fairly asserted that the ethical duty at the center of thisarticle, the physician's duty to notify patients of new medicaldevelopments, is consistent with the language and intent of severalimportant ethical principles and further serves to advance themodern conception of the physician-patient relationship.

los Other examples include attorney-client, guardian-ward, financial advisor-client, and

corporate officer-shareholder. Hafemeister & Spinos, supra note 2 at 1187; see also Mark A.Hall, Law, Medicine, and Trust, 55 STAN. L. REV. 463, 466 (2002) (arguing that trust is theunifying theme of health law). See generally David Orentlicher, Health Care Reform and thePatient-Physician Relationship, 5 HEALTH MATRIX 141, 147 (1995); Marc A. Rodwin, Strains inthe Fiduciary Metaphor: Divided Physician Loyalties and Obligations in a Changing Health Care

System, 21 AM. J.L. & MED. 241, 241 (1995).

109 See Hafemeister & Spinos, supra note 2, at 1195.

110 Id. at 1188.

ill Id. at 1184.

112 "Emergent medical risks" as used in the quoted article refers to medical errors andincidental clinical findings. See id. at 1167.

113 Id. at 1191 (citing Mink v. Univ. of Chicago, 460 F. Supp. 713, 720 (N.D. 111. 1978); Schwartzv. United States, 230 F. Supp. 536, 540 (E.D. Pa. 1964)).


V. STATUTORY DUTIES TO NOTIFY PATIENTS

Until the 1980s, there was no legal, regulatory, or ethical

obligation for physicians to notify patients about certain importantmatters related to their care, such as medical errors and adverseevents. 14 Traditionally, many physicians have been concerned about

potential malpractice liability and therefore have refrained from

disclosing explanatory health information to their patients.115 Indeed,standard risk management advice to physicians has been to not

admit any wrongdoing or even to express any regret at an

unfavorable treatment outcome, because such expressions could be

admitted into evidence in a subsequent malpractice case.116

Beginning in 1981, the AMA specifically mandated disclosures topatients of adverse events. 117 The Joint Commission for the

Accreditation of Health Care Organizations (now simply The Joint

Commission) also adopted a rule requiring the notification of

patients about outcomes of their care, including unanticipatedoutcomes.

1 1 8

Despite ethical rules and institutional accreditation standards,most physicians still do not provide full disclosure about medicalerrors.1 9 According to a 2006 mail survey of 2,637 physicians, only42% of responding physicians said they would make a full disclosure,including an explicit statement that an error occurred; 56% said theywould make a partial disclosure, mentioning the adverse event butnot the error; and 3% said they would make no reference to theadverse event or error.120 Because the survey involved self-reports

114 It is beyond the scope of this article to address the duties of physicians to report health-

related matters to parties other than the patient, such as public health authorities, law

enforcement agencies, or professional accrediting bodies.

115 David M. Studdert et al., Disclosure of Medical Injury to Patients: An Improbable Risk

Management Strategy, 26 HEALTH AFFAIRS 215, 215 (2007).

116 See id. (reviewing traditional risk management strategies and asserting that disclosure will

reduce liability).

117 See discussion, supra Part IV-C.

118 JOINT COMMISSION, HOSPITAL ACCREDITATION STANDARDS (2007).

119 Thomas H. Gallagher et al., Choosing Your Words Carefully: How Physicians Would Disclose

Harmful Medical Errors to Patients, 166 ARCHIVES INTERNAL MED. 1585, 1589-90 (2006).

120 Id.


about how much information the physicians would disclose in thefuture in a hypothetical case, it is arguable that in a real-life situation,actual disclosure rates would be lower.

Some experts contend that the reluctance of physicians todisclose information related to adverse events and medical errors is aleading cause of malpractice claims, because lawsuits often are filedwhen patients feel deceived or abandoned. 121 Regardless of itseffectiveness as a risk management strategy,122 disclosure is an ethicalobligation, and complete health information may advance the healthof the patient. To give effect to these considerations, in the 1990s,state legislatures began enacting "apology" and "disclosure" laws.123

This section discusses these state laws as well as recent federallegislation mandating the notification of patients in the event of ahealth information security breach. Taken together, these lawsindicate a major change in the regulation of physician-patientrelations to require more transparency and comprehensiveinformation sharing. Greater disclosure obligations are consistentwith the proposal in this article to establish a duty to notify patientsof new medical developments.

121 See Howard H. Hiatt et al., A Study of Medical Injury and Medical Malpractice, 321 NEW ENG. J.MED. 480 (1989); Gerald B. Hickson et al., Factors That Prompted Families to File MedicalMalpractice Claims Following Perinatal Injuries, 267 JAMA 1359, 1359 (1992); Wendy Levinsonet al., Physician-Patient Communication: The Relationship with Malpractice Claims AmongPrimary Care Physicians and Surgeons, 277 JAMA 553, 553 (1997); Tamara Relis, "It's NotAbout the Money!": A Theory on Misconceptions of Plaintiffs' Litigation Aims, 68 U. PITT. L. REV.341, 352 (2007). Cf. Allen Kachalia et al., Does Full Disclosure of Medical Errors AffectMalpractice Liability? The Jury Is Still Out, 29 JT. COMM'N J. QUALITY & SAFETY 503 (2003)(meta-analysis of studies did not allow for an estimate of the number of additional lawsuitsprevented by disclosure).

122 See Studdert et al., supra note 115.

123 See generally Allen Kachalia et al., Liability Claims and Costs Before and After Implementation of

a Medical Error Disclosure Program, 153 ANNALS INTERNAL MED. 213 (2010); Steve S. Kraman& Ginny Hamm, Risk Management: Extreme Honesty May Be the Best Policy, 131 ANNALSINTERNAL MED. 963, 963-966 (1999); Carol B. Liebman & Chris S. Hyman, A Mediation SkillsModel to Manage Disclosure of Errors and Adverse Events to Patients, 23 HEALTH AFFAIRS No. 4,at 22-32 (2004); Anna C. Mastroianni et al., The Flaws in State 'Apology' and 'Disclosure' LawsDilute Their Intended Impact on Malpractice Suits, 29 HEALTH AFFAIRS 1611, 1612 (2010);Michelle M. Mello & Thomas H. Gallagher, Malpractice Reform - Opportunities for Leadershipby Health Care Institutions and Liability Insurers, 362 NEW ENG. J. MED. 1353, 1354 (2010).


A. Medical Errors and Adverse Events

To promote openness in physician-patient communications,thirty-four states and the District of Columbia have enacted"apology" laws. 124 The laws differ, but they generally provide that ahealth care provider's oral or written communications of apology,regret, sympathy, compassion, mistake, or similar expressionsregarding a patient's unanticipated outcome may not be admittedinto evidence in a malpractice case and do not constitute anadmission of liability or a statement against interest.125 Significantly,these statements of apology are not legally required. 126 By contrast,nine states have enacted laws requiring the disclosure ofunanticipated outcomes.127 These laws, however, are usuallyapplicable only to institutional health care providers. 128 Moreover,they "require only a bare-bones statement that an unanticipatedoutcome occurred," without requiring an acknowledgement oferror.129 Whereas apology laws attempt to promote openness and to

124 ARIz. REV. STAT. § 12-2605; CAL. EVID. CODE § 1160; CAL. GOV'T CODE § 11440.45; COLO. REV.STAT. § 13-25-135; CONN. GEN. STAT. ANN. § 52-184D; DEL. CODE ANN. tit. 10, § 4318; D.C.CODE § 16-2841; FLA. STAT. § 90.4026; GA. CODE ANN. § 24-3-37.1; HAW. R. EVID. 409.5; IDAHOCODE § 9-207, IDAHO R. EVID. 414; IND. CODE § 34-43.5-1; IOWA CODE § 622.31; LA. REV. STAT.ANN. § 13:3715.5; ME. REV. STAT. ANN. tit. 24, § 2907; MD. CTS. & JUD. PROC. CODE ANN. § 10-920; MASS. GEN. LAWS ch. 233, § 23D; Mo. ANN. STAT. § 538.229; MONT. CODE ANN. § 26-1-814;NEB. REV. STAT. § 27-1201; N.H. REV. STAT. ANN. § 507-E:4; N.C. GEN. STAT. ANN. §8C-1, RULE413; N.D. CENT. CODE § 31-04-12; OHIO REV. CODE ANN. § 2317.43; OKLA. STAT. tit. 63, § 1-1708.1H; OR. REV. STAT. ANN. § 677.082; S.C. CODE ANN. § 19-1-190; S.D. CODIFIED LAWS § 19-12-14; TENN. R. EVID. 409.1; TEX. CIV. PRAC. & REM. CODE § 18.061; UTAH CODE ANN. § 78B-3-422, UTAH R. EVID. 409; VT. STAT. ANN. tit. 12, § 1912; VA. CODE ANN. § 8.01-52.1; VA. CODEANN. § 8.01-581.20.1; WASH. REV. CODE § 5.64.010; W. VA. CODE § 55-7-11A; WYO. STAT. ANN.§ 1-1-130.

125 See sources cited supra note 124.


127 CAL. HEALTH & SAFETY CODE § 1279.1 (West 2011); FLA. STAT. ANN. §§ 395.0197, 395.1051,

456.0575 (West 2011); FLA. ADMIN. CODE ANN. 64B8-8.001, 64B8-8.011 (2011); NEV. REV. STAT.§§ 439.855, 439.860 (West 2011); N.J. STAT. ANN. § 26:2H-12.25D (West 2011); N.J. ADMIN.CODE § 8:43E-10.7 (2011); OR. REV. STAT. ANN. § 442.837 (West 2011); 40 PA. CONS. STAT. ANN§ 1303.308 (West 2011); TENN. CODE ANN. § 68-11-211 (West 2011); VT. CODE ANN. fit. 18, §1915 (West 2011); VT. CODE R. § 12-5-16:2 (West 2011); WASH. REV. CODE § 70.41.380 (West2011).


129 Mastroianni et al., supra note 123, at 1615.


protect physicians from malpractice liability, disclosure laws attemptto promote the interests of patients in learning the existence andcause of adverse outcomes. Although these statutes must be regardedas extremely limited or tentative steps, at least they are steps in theright direction. They further support the need to encourage or evencompel additional communications by physicians to patients.

B. Health Information Security Breaches

The Health Information Technology for Economic and ClinicalHealth (HITECH) Act,130 Title XIII of the American Recovery andReinvestment Act of 2009,131 contains a provision directing theSecretary of Health and Human Services (HHS) to issue regulationssetting forth the breach notification obligations of entities subject tothe Health Information Portability and Accountability Act (HIPAA)Privacy Rule.132 The HITECH Act requires HIPAA covered entities toprovide notification to affected individuals and to the Secretary ofHHS following the discovery of a breach of unsecured protectedhealth information. 133 In addition to the federal requirement, laws inforty-six states and the District of Columbia mandate the notificationof health information security breaches, although the details varyamong the states.134

130 Health Information Technology for Economic and Clinical Health Act, Pub. L. No. 111-5,

123 Stat. 115, 226, 263 (2009).

131 Title XIII of the American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5, 123

Stat. 115 (2009).

132 Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. No. 104-191,

110 Stat. 1936 (codified as amended in scattered sections of titles 18, 26, 29, and 42 U.S.C.).The HIPAA Privacy Rule is codified as follows: Standards for Privacy of IndividuallyIdentifiable Health Information, 45 C.F.R. pt. 164 subpart E (2010); see also 45 C.F.R. §160.103(defining "individually identifiable health information"). The covered entities are healthcare providers, health plans, health clearinghouses, and business associates of the first threeentities. 45 C.F.R. § 160.102 (2010).

133 42 U.S.C.A. § 17932 (West 2011).

134 ALASKA STAT. § 45.48.010(a), (b) (2011); ARIz. REV. STAT. ANN. § 44-7501(a) (2010); ARK.

CODE ANN. §§ 4-110-101, 4-110-105 to -108 (West 2011); CAL. CIV. CODE §§ 56.06, 1785.11.2,1798.29, 1798.82 (West 2011); COLO. REV. STAT. ANN. § 6-1-716(1)(a), 2(a) (West 2012); CONN.GEN. STAT. ANN. § 36a-701b(a-b) (2011); DEL. CODE ANN. tit. 6, § 121-101 (West 2011); D.C.CODE § 28-3851 to -3852 (2012); FLA. STAT. § 817.5681(1)(a) (2011); GA. CODE §§ 10-1-910 to -

912 (2011); HAW. REV. STAT. § 487N-2 (2011); IDAHO CODE ANN.. §§ 28-51-104 to -107 (2012);815 ILL. COMP. STAT. ANN. § 530/1, 530/10,530/15 (2011); IND. CODE §§ 24-4.9-1-1, 24-4.9-2-2,4-

119

According to the federal regulations, except when lawenforcement requests a delay, a covered entity is required to send anotice within sixty calendar days of discovering the breach.135 Thenotice must include the following: (1) a brief description of whathappened, the date of breach, and the date of discovery; (2) a briefdescription of the types of health information involved; (3) any stepsindividuals should take to protect themselves from harm due to thebreach; (4) a brief description of what steps the covered entity istaking to investigate the breach, minimize resulting injury, andprevent a breach from recurring; and (5) contact information. 136 Thenotice must be written in plain language137 and sent by first-classmail or, according to prior agreement with the recipient, by electronicmail. 138 In urgent situations, where there is possible imminent misuseof the information, the covered entity may provide notice bytelephone or other suitable means. 139 Notification also must beprovided to the media, and the Secretary is required to post on the

1-11-1 to -10 (2011); IOWA CODE ANN. §715C.1-715C.2 (West 2011); KAN. STAT. §§ 50-7a01, 50-7a02 (2011); LA. REV. STAT. ANN. § 51:3071,51:3074 (2011); ME. REV. STAT. tit. 10, § 1347,1347-A (2011); MD. CODE ANN., COM. LAW § 14-3501, 14-3504(2011); MASS. GEN. LAWS ANN. ch.93H, §§1-3 (2011); MICH. COMP. LAWS ANN. § 445.72 (West 2011); MINN. STAT. ANN. §§325E.61, 325E.64 (West 2011); H.B. 583, 2010 Leg. (Miss. 2010); Mo. REV. STAT. ANN. §407.1500 (2011); MONT. CODE §§ 30-14-1704, 2-6-504 (2011); NEB. REV. STAT. ANN. §§ 87-801 to-807 (2011); NEV. REV. STAT. ANN. §§ 603A.010, 603.220 (West 2010); N.H. REV. STAT. §§ 359-C:19 to -C:21 (2011); N.J. STAT. ANN. § 56:8-163 (West 2011); N.Y. Bus. LAW § 899-aa(1)(a, c),(8)(a) (2011); N.C. GEN. STAT. § 75-65 (2011); N.D. CENT. CODE ANN. § 51-30-01to -07 (West2011); OHIO REV. CODE ANN. §§ 1347.12, 1349.19, 1349.191, 1349.192 (West 2011); OKLA. STAT.§§ TIT. 74, § 3113.1, tit. 24§§ 161 to 166 (2011); OR. REV. STAT. ANN. § 646A.600-.604 (West2011); 73 PA. CONS. STAT. ANN. §2303 (2011); R.I. GEN. LAWS § 11-49.2-1 to -4 (2011); S.C. CODEANN. § 39-1-90 (2011); TENN. CODE ANN. § 47-18-2107 (2011); TEx. BUS. & COM. CODE §521.053 (West2011); UTAH CODE ANN. §§ 13-44-101, -102, -201, -202, -301(West 2011); VT.STAT. ANN. tit. 9, §§ 2430, 2435 (West 2011); VA. CODE ANN. §§ 18.2-186.6, 32.1-127.1:05 (West2011); WASH. REV. CODE ANN. §§ 19.255.010, 42.56.590 (West 2012); W. VA. CODE ANN. § 46A-2A-101 to -105 (West 2011); WIS. STAT. ANN. § 134.98 (West 2011); WYo. STAT. §§ 40-12-501 to -502 (2011).

135 See 45 C.F.R. §§ 164.404(b), 164.412 (2012); Breach Notification for Unsecured ProtectedHealth Information, 74 Fed. Reg. 42,768-69 (Aug. 24, 2009).

136 45 C.F.R. § 164.404(c)(1); Breach Notification for Unsecured Protected Health Information,

74 Fed. Reg. 42, 768 (Aug. 24, 2009).

137 Id. at (c)(2).

138 Id. at (d)(1).

139 Id. at (d)(3).



HHS website a list of covered entities that experience breachesinvolving more than 500 individuals.140

Neither federal nor state laws establish comprehensivenotification obligations in the event of a health information securitybreach.1 41 As with the limited protections of state "apology" and"disclosure" laws, these provisions establish growing support for thepublic policy of health care providers and institutions sharingimportant information with patients. 142

VI. COMMON LAW LIABILITY FOR FAILING TO INFORM,

WARN, OR NOTIFY

A. Informed Consent

Informed consent has become the centerpiece of the physician-patient relationship in medical ethics143 as well as in health carelaw.144 It establishes the duty of a physician to inform patients abouttheir diagnosis, the nature of the proposed treatment, its benefits andpossible risks, and available alternatives (including refraining fromtreatment)- all in an understandable fashion.145 Two standards have

140 See Health Information Technology for Economic and Clinical Health Act, Pub. L. No. 111-

5, 123 Stat. 115, 261-62 (2009); Breach Notification for Unsecured Protected Health

Information, Interim Final Rule, 74 Fed. Reg. 42, 740 (2009).

141 See generally GINA STEVENS, CONG. RESEARCH SERV., RL 34120, FEDERAL INFORMATION

SECURITY AND DATA BREACH NOTIFICATION LAWS 1-2 (2010); Paul M. Schwartz & Edward J.

Janger, Notification of Data Security Breaches, 105 MICH. L. REV. 913, 913 (2007); Jane K. Winn,

Are "Better" Security Breach Notification Laws Possible?, 24 BERKELEY TECH. L.J. 1133, 1133,

1135 (2009).

142 Thomas H. Gallagher & Mary Hardy Lucas, Should We Disclose Harmful Medical Errors to

Patients? If so, How?, 12 NEW ENG. J. MED. 253, 253, 257 (2005); Agency for Healthcare

Research and Quality, In Conversation with...Thomas H. Gallagher, MD, AHRQ WEBM&M:

MORBIDITY & MORTALITY ROUNDS ON THE WEB - PERSPECTIVES ON SAFETY (Jan. 2009),http://webmm.ahrq.gov/perspective.aspx?perspectiveID-69.

143 See supra Part IV-B.

144 See Canterbury v. Spence, 464 F.2d 772, 781 (D.C. Cir. 1972). See generally Susan M. Wolf,

Toward a Systemic Theory of Informed Consent in Managed Care, 35 HOUS. L. REV. 1631 (1999);Jay Katz, Informed Consent - Must It Remain a Fairy Tale?, 10 J. CONTEMP. HEALTH L. & POL'Y

69 (1994); Alan J. Weisbard, Informed Consent: The Law's Uneasy Compromise with EthicalTheory, 65 NEB. L. REV. 749 (1986).

145 See generally JESSICA W. BERG ET AL., INFORMED CONSENT: LEGAL THEORY AND CLINICAL


been used in state courts to evaluate the disclosure performance - the"reasonable physician" standard (what reasonable physicians telltheir patients before rendering care) and the "reasonable patient"standard (what reasonable patients need to know in order to make aninformed decision).146 Failure to meet the standard of disclosureresults in the medical treatment being nonconsensual care with thefollowing legal liabilities: (1) nonconsensual physical interactionamounts to battery;147 and (2) failure to provide adequate informationis a breach of the duty owed to patients - i.e., malpractice. 148 In recentyears, because most informed consent cases involved only inadequateinformation (as opposed to no information at all), malpractice hasbecome the dominant liability theory, leaving battery to more severecases such as in fraudulent concealment or unwanted forced care.149

Pertinent to this article, failure to provide timely information canhave a major impact on a patient's life and health, and it is easy to seewhy patients would expect to be informed. 150 However, the duty ofinformed consent has been applied mostly for prospective or ongoingtreatment. 151 Thus, it is questionable whether it can be applied to theduty to notify patients of new medical discoveries after an episode of

PRACTICE 45-46 (2nd ed. 2001); FADEN & BEAUCHAMP, supra note 86, at 30-34 (discussing

three different legal standards for determining the scope of informed consent).

146 For a tabulation of states' informed consent laws, see Jamie Staples King & Benjamin

Moulton, Rethinking Informed Consent: The Case for Shared Medical Decision-Making, 32 AM.

J.L. & MED. 429, 493-501 (2006).

147 Tortious battery requires intent to make physical contact with another person's body

without consent. See RESTATEMENT (SECOND) OF TORTS § 13 (1965). The individual need notintend to cause a particular harm or even to do wrong. See id. & cmt. c.

148 See Canterbury, 464 F.2d at 781 (D.C. Cir. 1972).

149 See, e.g., Nathanson v. Kline, 350 P.2d 1093 (Kan. 1960); Tisdale v. Pruitt, 394 S.E.2d 857

(S.C. Ct. App. 1990) (holding that unauthorized dilation and curettage was actionable under

the informed consent doctrine); See Mills v. Rogers, 457 U.S. 291 (1982) (remanding for

consideration of whether state law grants involuntarily committed mental patients a right to

refuse antipsychotropic drugs). See also Jay Katz, Informed Consent-- A Fairy Tale? -- Law'sVision, 39 U. PiTt. L. REV. 137, 151-53 (1977); E. Haavi Morreim, Medical Research Litigation

and Malpractice Tort Doctrines: Courts on a Learning Curve, 4 HoUS. J. HEALTH L. & POL'Y 1, 52-

63 (2003).

150 Joan H. Krause, Can Health Law Truly Become Patient Centered?, 45 WAKE FOREST L. REV.

1489, 1491-92 (2010).

151 See Morreim, supra note 149, at 63.


care.152

B. Medical Malpractice

To prevail in a malpractice action a plaintiff must establish thatthe physician has breached the duty of care owed to the patient(based on a legally binding physician-patient relationship) byperforming below the standard of care expected from a reasonablephysician under the same circumstances and that the breach directlybrought about the complained-of injuries* (causation).1 53 In thisregard, assuming a duty of care (which is questionable in somenotification scenarios, as mentioned earlier 154), failure to notify apatient about material risks can be construed as a failure to meet theduty of a reasonable physician, resulting in malpractice liability.

There have been relatively few malpractice cases involving ahealth care provider's alleged failure to apprise patients of newinformation of direct relevance to their health. In Pisano v. Ferrara,155 adentist was held liable for failing to inform a patient of the need toremove a dental implant later determined to be linked to tumors. Onthe other hand, in Melton v. Medtronic, Inc.,156 although the duty toinform was acknowledged, a cardiologist was not liable for failing toinform a patient of defects in an implanted cardiac defibrillatorbecause there was insufficient evidence of harm proximately causedby the delay in notification.

Because the standard of care is based on the generally recognizedand accepted practices of physicians, it is essential to identify anddelineate the situations where physicians should notify their currentor past patients. To this end, professional associations shouldrespond to the advancements in HIT and create workable guidelinesfor their members, an effort that could instruct the courts and

152 See id. at 63-86 and accompanying notes.

153 Edward B. Hirshfeld, Practice Parameters and the Malpractice Liability of Physicians, 263 JAMA

1556, 1556 (1990).

154 See supra note 129 and accompanying text.

155 Pisano v. Ferara, A-6663-06T3, 2008 WL 4392216 (N.J. Super. Ct. App. Div. 2008).

156 Melton v. Medtronic, Inc., 698 S.E.2d 886 (S.C. Ct. App. 2010).


regulators.157

Opponents of this recommendation might argue that recognizinga duty to notify in position papers and guidelines will result in aclearer obligation, from which a deviation might be regarded as acompensable breach of duty.158 Nevertheless, courts are likely torecognize a duty to notify patients even without professionalrecognition, and the lack of input by professional groups will merelycede development of the field to others.

A physician's duties arising from informed consent generallydiffer from those actionable as malpractice. As for the latter, thestandard used by all jurisdictions is the reasonable physician. 59 Forinformed consent, however, some jurisdictions use the reasonablephysician standard, whereas others use the reasonable patientstandard.160 This in turn might imply that failure to meet a patient'sexpectation to be notified might result in a breach of duty on the partof the physician. Consequently, in such jurisdictions, the shield ofclinical guidelines and common practices loses its might, and courtswill reconstruct the patient's informational needs in a way that isharder to anticipate. Accordingly, HIT allows physicians in suchcircumstances to address this difficulty up front, by requesting theirpatients to indicate if they want to be notified and, if so, theirpreferred method, such as e-mails or social networks.

Some analogies can be drawn to the legal scholarship on re-

157 See Ky. REV. STAT. ANN. § 342.035(8)(b) ("Any provider.., who has followed the practice

parameters or guidelines developed or adopted pursuant to this subsection shall bepresumed to have met the appropriate legal standard of care in medical malpracticecases...."); Hinlicky v. Dreyfuss 848 N.E.2d 1285 (N.Y. 2006) (holding professional

guidelines are admissible as evidence of the standard of care). See generally Ronen Avraham,Clinical Practice Guidelines: The Warped Incentives in the U.S. Healthcare System, 37 AM. J. L. &MED. 7, 7, 16-23, 26-27 (2011); Michelle M. Mello, Of Swords and Shields: The Role of Clinical

Practice Guidelines in Medical Malpractice Litigation, 149 U. PA. L. REV. 645, 647 (2001); Scott B.Ransom et al., Reduced Medicolegal Risk by Compliance With Obstetric Clinical Pathways: ACase-Control Study, 101 OBSTETRICS & GYNECOLOGY 751, 754-55 (2003); Arnold J. Rosoff,Evidence-Based Medicine and the Law: The Courts Confront Clinical Practice Guidelines, 26 J.HEALTH POLITICS POL'Y & L. 327, 352-53 (2001).

158 See Ransom, supra note 157, at 754.

159 See generally 61 Am. Jur. 2d Physicians, Surgeons, Etc. § 287 (2012).

16o See, e.g., Canterbury v. Spence 464 F.2d 772, 781 (D.C. Cir. 1972) (using reasonable patientstandard).


contacting for "incidentaloma" - the discussion on the appropriateaction expected from a physician or a researcher in light of incidentalfindings (e.g., a tumor identified during a CT scan ordered foranother purpose, an experimental fMRI study, or a mutated genediscovered during a whole genome study).161 The issue is whetherthere is a legal duty to notify patients when information did notaccrue during or as a result of rendering health care. Scholarsgenerally have recommended a proactive approach, in which bothparties discuss the possibility of incidental findings and the way todeal with them in advance. 162 Courts have been reluctant to establisha legal duty absent a recognized relationship, 163 but some scholarsbelieve that such a stance fails to protect the legal rights of researchsubjects.164

Israel, a common law jurisdiction, had a unique case involving

161 For a detailed symposium, see Symposium, Incidental Findings in Human Subjects Research:

From Imaging to Genomics, 36 J. L. MED. & ETHICS 216-383 (2008). See also L.L. Berlard et al.,

Managing Incidental Findings on Abdominal CT: White Paper of the ACR Incidental FindingsCommittee, 7 J. AM. COLL RADIOL. 754 (2011); Matthew P. Gordon, A Legal Duty to DiscloseIndividual Research Findings to Research Subjects?, 64 FOOD & DRUG L.J. 225 (2009); Erica K.

Rangel, The Management of Incidental Findings in Neuro-Imaging Research: Framework andRecommendations, 38 J.L. MED. & ETHICS 117 (2010).

162 Susan M. Wolf et al., The Law of Incidental Findings in Human Subjects Research -- Establishing

Researchers' Duties, 36 J. L. MED & ETHICS 361 (2008); NATIONAL RESEARCH COUNCIL AND

INSTITUTE OF MEDICINE, ETHICAL CONSIDERATIONS FOR RESEARCH ON HOUSING-RELATED

HAZARDS INVOLVING CHILDREN (2005).

163 See Ande v. Rock., 647 N.W.2d 265 (Wis. Ct. App.), cert. denied, 650 N.W.2d 840 (Wis.

2002), cert. denied, 537 U.S. 1107 (2003) (malpractice claims dismissed on grounds that

investigators did not have a physician-patient relationship with the research subject). But see

Blaz v. Michael Reese Hosp. Fdn., 74 F. Supp. 2d 803 (N.D. I1. 1999) (holding a researcher

had a duty under Illinois law to disclose the risks to individuals exposed to radiation

therapy of the sort received by the plaintiff).

164 See, e.g., E. Haavi Morreim, Medical Research Litigation and Malpractice Tort Doctrines: Courts

on a Learning Curve, 4 Hou. J. HEALTH L. & POL'Y 1, 86 (2003) ("Research litigation differs

importantly from ordinary medical malpractice litigation. Familiar tort doctrines such asnegligence, battery, and informed consent simply do not fit the realities of research and, if

they are applied thoughtlessly in this emerging body of cases, the danger is great that

research participants will be left without appropriate compensation for very real injuries,

and reciprocally that investigators may be subjected to unfair standards of liability. Courtsneed to recognize clinical research as a distinct area of medical activity and to attune tort

doctrines specifically to its nuances."); see also T.C. Booth et al., Incidental Findings Found in"Healthy" Volunteers During Imaging Performed for Research: Current Legal and EthicalImplications, 83 BRIT. J. RADIOL. 456 (2010).


the duty to notify and malpractice on a large scale. In the early 1950s,tens of thousands of new immigrants from Asian and North Africancountries were treated with low-dose radiation for tinea capitis.1 65

After forty years, it became known that the treatment created asignificant risk of developing various head and neck tumors (such astumors of the thyroid and brain).166 As a result, the Ministry ofHealth issued a warning to general practitioners and family doctorsto pay special attention in this population to complaints or symptomsthat might indicate the progression of such a tumor.167

Unsurprisingly, litigation resulted from the alleged failure to identifythe manifestations of head and neck tumors. In 2006, a lower court inIsrael found a physician in breach of his duty for failure to notify apatient of his high-risk situation, even though the patient had nocomplaints or symptoms. 168 The court reasoned that even though anational standard of follow-up (i.e., waiting for complaints orsymptoms, or performing an annual MRI on such a large population)is ineffective or prohibitively expensive, the patient could havechosen another strategy of risk assessment other than waiting forsymptoms, which usually appear at a more advanced stage.169 Thepatient convinced the court that he would have opted for an annualMRI scan, even at his own expense (his HMO stated in court that itwould not have covered these high expenses).170 Thus, notificationcan be regarded as the impetus for a patient's opportunity to preventharm, and the lack of notice prevented him from beneficial action.

165 Tinea capitis, also known as ringworm of the scalp, is a fungal infection mainly affecting

children that is contagious and may become epidemic. THE MERCK MANUAL OF DIAGNOSIS

&THERAPY 706 (19th ed. 2011); NAT L ACAD. OF SCIENCES, HEALTH RISKS FROM EXPOSURE TO

Low LEVELS OF IONIZING RADIATION: BEIR VII (2005); Ron E. Modan et al., Tumors of the

Brain and Nervous System after Radiotherapy in Childhood, 319 N. ENG. J. MED. 1033 (1988); S.

Sadetzki et al., Long-Term Follow-up for Brain Tumor Development after Childhood Exposure to

Ionizing Radiation for Tinea Capitis, 163 RADIAT. RES. 424 (2005).

166 Id.

167 Directive 17/09, Israeli Ministry of Health [in Hebrew, on file with authors]

168 DC (Jer) 6347/05 Sima Rheuben v. State of Israel [2006] (Isr.). (decision in Hebrew on file

with the authors).

169 Id.

170 Id.


This is another application of the doctrine of "loss of a chance." 171

The analogy between the duty to notify and managing incidentalfindings in research is imperfect. On the one hand, research subjectsoften act out of a strong sense of altruism, and this fact might suggesta greater responsibility on the part of researchers. 172 On the otherhand, incidental findings often involve information that is notclinically actionable, whereas the essence of patient notification inclinical settings involves information that has clinical utility andarises out of the special fiduciary obligation of the physician-patientrelationship.

C. A Duty to Warn

The duty to warn, although arising from the physician-patientrelationship, involves duties owed by physicians to non-patient thirdparties. In the famous Tarasoff case, 173 a psychotherapist (clinicalpsychologist) was liable for failure to warn an identified third partyabout the imminent danger of violence likely to be perpetrated by thetherapist's patient. The court offered the following criteria todetermine the existence of the therapist's duty to warn: (1)foreseeability of the harm, probably the most important componentin establishing a duty, and usually based on a special relationship; (2)degree of certainty; (3) the closeness of the connection between theprofessional's action or omission and the injury; (4) moral blame ofthe professional's action; (5) policy of preventing further harm; (6)extent of burden on the professional and his or her community; and(7) availability, cost, and prevalence of insurance for the risk

171 In the typical "loss of chance" case, the plaintiff asserts that the defendant's malpractice

(e.g., failure to make a timely diagnosis) prevented the plaintiff from obtaining treatment,even though the treatment was likely to be unsuccessful. See Robert S. Bruer, Loss of a Chanceas a Cause of Action in Medical Malpractice, 59 Mo. L. REV. 969 (1994); David W. Feeder II,When Your Doctor Says, "You Have Nothing to Worry About," Don't Be So Sure: The Effect ofFabio v. Bellomo on Medical Malpractice Actions in Minnesota, 78 MINN. L. REV. 943 (1994).

172 See Grimes v. Kennedy Krieger Inst., Inc., 782 A.2d 807 (Md. 2001) (holding researchers

have duties to research subjects). See also Wolf et al., supra note 162.

173 Tarasoff v. Regents of Univ. of Cal., 551 P.2d 334, 334 (Cal. 1976). See generally Alan A.

Stone, The Tarasoff Decisions: Suing Psychotherapists to Safeguard Society, 90 HARV. L. REV. 358(1976).


involved.174

Following Tarasoff, other cases of duty to warn and third-partyrights emerged, especially with respect to communicable diseases, 175

impairments in daily functions such as operating an automobile, 176

and genetics.177 One particular type of professional duty to warn case,involving HIV/AIDS, has been the subject of a few tort cases andseveral scholarly articles. 178 In Reisner v. Regents of the University ofCalifornia, the plaintiff Daniel Reisner alleged that Jennifer Lawson, a

174 Tarasoff, 551 P.2d at 342.

175 See Bradshaw v. Daniel, 854 S.W.2d 865, 866 (Tenn. 1993) (finding liability based on failure

to warn a spouse about the risk of environmental exposure to Rocky Mountain SpottedFever, which caused the death of the patient); C. W. v. Cooper Health Sys., 906 A.2d 440,452 (N.J. 2006) (finding liability for a third party contracting AIDS); DiMarco v. LynchHomes-Chester Cnty., Inc., 583 A.2d 422, 424 (Pa. 1990) (finding liability where a third partycontracted hepatitis B). See generally Allison L. Almason, Personal Liability Implications of theDuty to Warn Are Hard Pills to Swallow: From Tarasoff to Hutchinson v. Patel and Beyond, 13 J.CONTEMp. HEALTH L. & POL'Y 471 (1997).

176 See Taylor v. Smith, 892 So. 2d 887, 888 (Ala. 2004) (holding physician liable for

administering methadone on an outpatient basis to patient who later caused auto accident);Coombes v. Florio, 877 N.E.2d 567, 574-75 (Mass. 2007) (holding physician may be liable tothird-party for failing to warn patient of side-effect of treatment); Hardee v. Bio-Med.Applications of S.C., Inc., 636 S.E.2d 629, 631-32 (S.C. 2006) (holding dialysis center liablefor harms caused by failing to perform post-treatment test or warn patient who later wasinvolved in auto accident). See generally Kathryn J. Schwartz, Coombes v. Florio: TheNegative Consequences of Leaving Massachusetts Physicians Open to Endless Third-Party Liability,45 NEW ENG. L. REV. 777 (2011).

177 Compare Pate v. Threlkel, 661 So. 2d 278, 279 (Fla. 1995) (holding physician satisfied any

duty to patient's children by informing patient of genetic basis of her medullary thyroidcarcinoma), with Safer v. Estate of Pack, 677 A.2d 1188, 1192 (N.J. 1996) (holding physicianhad a duty to warn those known to be at risk of a genetically transmissible condition), cert.

denied, 683 A.2d 1163 (N.J. 1996). Safer was legislatively overruled. N.J. STAT. ANN. § 10:5-47(West 2001). See also Mary L. Kovalesky, To Disclose or Not to Disclosure: Determining the Scopeand Exercise of a Physician's Duty to Warn Third Parties of Genetically Transmissible Conditions,76 U. CIN. L. REV. 1019, 1020 (2007-2008); Am. Soc'y of Human Genetics Soc. Issues

Subcomm. on Familial Disclosure, Professional Disclosure of Familial Genetic Information, 62AM. J. HUM. GENETICS 474 (1998); Kenneth Offit et al., The "Duty to Warn" a Patient's FamilyMembers About Hereditary Disease Risks, 292 JAMA 1469, 1470 (2004); Sonia M. Suter, WhoseGenes Are These Anyway? Familial Conflicts Over Access To Genetic Information, 91 MICH. L.REV. 1854, 1883 (1993).

178 See, e.g., Troyen A. Brennan, AIDS and the Limits of Confidentiality: The Physician's Duty to

Warn Contacts of Seropositive Individuals, 4 J. GEN. INTERNAL MED. 242, 244 (1989); Bernard M.Dickens, Legal Limits of AIDS Confidentiality, 259 JAMA 3449, 3449 (1988); Kenneth E.Labowitz, Beyond Tarasoff: AIDS and the Obligation to Breach Confidentiality, 9 ST. LOUiS U.PuB. L. REV. 495, 495 (1990).


twelve year-old girl, received a blood transfusion in 1985 at theUCLA Medical Center.179 Her physician, Dr. Eric Fonklesrud, and thehospital became aware the day after the transfusion that the bloodwas contaminated with HIV, but they did not inform JenniferLawson or her parents. 180 In 1988, when Jennifer Lawson was fifteen,she had sexual relations with Daniel Reisner.181 In 1990, Dr.Fonklesrud diagnosed Jennifer as having AIDS and she died onemonth later.182 When Jennifer's parents notified Daniel, he was testedand found to be HIV-positive.183 He sued Jennifer's physician andhospital based on a failure to warn. 84 The California Court ofAppeals, relying on Tarasoff, held that the physician and hospital hada duty to apprise Jennifer or her parents of her HIV risk, and thebreach of the duty led to Daniel's harm.185

Reisner did not involve the issue of whether a physician has aduty to notify directly the foreseeable contacts of a patient with asexually transmitted infection, such as a spouse or known sexualpartner. 86 The HIPAA Privacy Rule, effective in 2003, prohibits ahealth care provider's direct notification of non-patient, at-riskindividuals, thereby limiting the physician's duty to notify their

179 Reisner v. Regents of the Univ. of Cal., 37 Cal. Rptr. 2d 518, 519 (Ct. App. 1995) (settledafter the court's decision).

180 Id.

181 Id.

182 Id.

183 Id.

184 Reisner, 37 Cal. Rptr. 2d at 519.

185 Id. at 524; see also DiMarco v. Lynch Homes - Chester Cnty., Inc., 583 A.2d 422, 425 (Pa.1990) (physician's patient-nurse received a needle stick injury from a patient with hepatitis;physician incorrectly told her she could resume sexual activity if she was symptom freeafter six weeks; court held physician owed a duty to the nurse's boyfriend who becameinfected after sexual relations).

1s6 The American Medical Association has taken the position that "a physician [should]attempt to persuade an HIV-infected patient to cease all activities that endangerunsuspecting others and to inform those whom he/she might have infected. If suchpersuasion fails, the physician should pursue notification through means other than byreliance on the patient, such as by the Public Health Department or by the physiciandirectly." AM. MED. ASS'N, HIV/AIDS Reporting, Confidentiality, and Notification, Policy No.H-20.915 (2009).


patient and, where mandated by law, public health officials. 87 ThePrivacy Rule 8 8 prohibits warnings beyond the narrow facts of theTarasoff decision, and generally prohibits the disclosure of personallyidentifiable health information without the authorization of the

patient. There are several exceptions, and one of them permitsdisclosures to prevent an imminent harm. 8 9

Thus, it would appear that actions to avert a serious and

imminent threat are permitted, but warnings about less immediateharms, such as those caused by a genetic predisposition or infectious

disease, are not permitted by the Privacy Rule.190 It should be noted

that these provisions apply to warnings by a physician to third

persons, and they do not relieve a physician's duty to provide healthinformation to a patient, including a recommendation to inform other

at-risk individuals. Indeed, the prohibition of physicians contactingat-risk individuals without patient consent makes patient notificationeven more important. The preceding discussion also does not affectthe legal and ethical duties of a patient to inform at-risk familymembers (in the case of genetic disorders) or close contacts (in the

case of infectious diseases). The development of a physician's limitedduty to warn, however, is consistent with the proposal for aphysician's limited duty to notify.

187 For coverage of the HIPAA Privacy Rule, see FADEN & BEAUCHAMP, supra note 86 at 98-99.

188 Id.

159 45 C.F.R. § 164.512(j)(1) (2010):

(1) Permitted disclosures. A covered entity may, consistent with applicable law andstandards of ethical conduct, use or disclose protected health information, if thecovered entity, in good faith, believes the use or disclosure:

(i)(A) Is necessary to prevent or lessen a serious and imminent threat to thehealth or safety of a person or the public; and

(B) Is to a person or persons reasonably able to prevent or lessen the threat,including the target of the threat...

19 The HIPAA Privacy Rule generally preempts state laws. "A standard, requirement, or

implementation specification adopted under this subchapter that is contrary to a provisionof State law preempts the provision of State law .. " 45 C.F.R. § 160.203 (2010). Anotherprovision permits state laws to operate without federal preemption if they serve a

compelling need related to public health, safety, or welfare. Id. § 160.203(a)(1)(iv). Adetermination by the Secretary is required. Id.


VII. THE DIMENSIONS OF THE PROPOSED DUTY TO NOTIFY

The physician's duty to notify patients advocated in this articleshould be limited in order to be effective for patients; to be minimallyburdensome for physicians; and to have a realistic chance of adoptionby physicians, codes of ethics, and the courts. An unlimited dutywould be unreasonable, impractical, and could be extended withoutlimits, such as by requiring pediatricians to follow up with theirpatients for the rest of their patients' lives. Although limits areobviously needed, it is less obvious what the limits should be or howthey should be set. This section presents a framework for analyzingsome of the specifics regarding the duty to notify patients, includingwhat patients should be notified, when the duty to notify arises, andwhat physicians should do to satisfy the duty.

A. Selecting the Patients to Be Notified

There are two main ways in which the potential patientpopulation for notification can be limited to the patients most likelyto benefit from notice with the least burden on physicians. First,notification duties could extend only to "current" or "active"patients. An advantage of this approach is that it eliminatesduplicate notification of former patients who have a new physician.On the other hand, it is not always clear who is a "current" patient.A patient last seen two months ago may have no intent to return,whereas a patient last seen two years ago may be a continuingpatient. In addition, a patient seeing a specialist for a singleconsultation may rely on the treatment recommendation of thatspecialist for a substantial length of time.

The second possible method of limiting the class of patients to benotified is to use a time limit. In other words, patients last seenwithin a certain period of time would be subject to notification, butpatients not seen within that period need not be notified. Thisapproach would be easier to implement. The duty to notify patientslast seen within a certain period of time should be the minimumethical and legal requirement; nothing would prevent physiciansfrom providing notification to additional patients depending on thesituation. Complicating questions are whether the same rule shouldapply to both generalists and specialists and whether its applicability


should be affected by the number of times a patient has been seen.Although the nature of the physician-patient relationship is relevantin determining the duty to notify, the significance and clinical utilityof the information are the determinative factors. Thus, the duty tonotify patients of potentially life-saving information, such as aserious drug interaction, would apply more broadly than a lessserious or less imminent risk.

As to the question of what time period should be used, it wouldbe appropriate to adopt the Medicare billing rule that deems a patientwho has been seen within the past three years as "established,"whereas a patient who has not been seen within the past three yearswould be considered "new" if he or she made a return visit to thatphysician.191 Thus, all patients seen within the last three years (ortheir legally designated representatives) should be provided withnotice about new medical developments. The date of last visit is aneasily aggregated data element in an EHR.

Another important issue is what party should be responsible forproviding the notice. Many patients obtain their health care frominstitutional providers, such as a multi-specialty group practice,health maintenance organization, or public health clinic. In thesesituations, the institution, rather than the individual physician, thatprovided the last episode of care should have the obligation toprovide notification. Because of the evolving nature of practicearrangements and relationships, physicians and institutions shouldclearly establish the appropriate party for notification. Institutionsalso should establish protocols for allocating notificationresponsibilities, and they should undertake continuous qualityassessment and improvement to ensure that the notificationobligations are being met efficiently and effectively.

191 See Medicare Program: Changes to the Hospital Outpatient Prospective Payment Systemand CY 2009 Payment Rates, 73 Fed. Reg. 68502, 68679 (Nov. 18, 2008) (to be codified at 42C.F.R. pts. 410, 416, & 419) ; see also Medicare Program Prospective Payment System forHospital Outpatient Services, 65 Fed. Reg. 18434, 18451 (Apr. 7, 2000) (to be codified at 42C.F.R. pts. 409, et al).


B. Determining When There is a Duty to Notify Patients

The most difficult technical issue is deciding when the medicalscience has evolved sufficiently that the benefits of notificationoutweigh the burdens. As emphasized in this article, because of HIT,the burdens on physician notification will be sharply curtailed,thereby suggesting that notification will be appropriate in moresituations. Nevertheless, notification is not without its own risks,including patient confusion, and therefore should be undertaken onlyon the basis of compelling scientific evidence. Preliminary,ambiguous, inconclusive, or minor findings should not be the basisfor patient notification.

The following is a non-exclusive list of potential reasons forissuing patient notifications: (1) drug interactions, adverse events,and market withdrawals; (2) medical device recalls and warnings; (3)new treatment modalities with substantially enhanced efficacy; (4)changes in important lifestyle recommendations; and (5) significantnew monitoring and imaging guidelines of preventive medicine.Each case requires a separate analysis of the burdens, benefits, andrisks of notification.

The overriding purpose of notification is to provide substantialbenefit to the patient. The concept of benefit includes clinical utility,but it is broader. The clinical utility aspect of benefit involves ananalysis of objective factors, such as the severity of the condition andthe likelihood that care will be altered based on the notification. Incontrast, psychosocial aspects of benefits and harms are patient-specific and require a patient-centered approach. Patients withsimilar medical conditions may have very different views on thedesirability of receiving information about new medicaldiscoveries. 192 One approach would be for physicians to ask each newpatient and all patients periodically whether they want to beinformed of new developments with the potential to affect theirhealth significantly. Patient notification preferences should be astandard data element in EHRs.

192 There is robust literature on this issue in genetics. See, e.g., Constance A. Griffin et al.,

Patient Preferences Regarding Recontact by Cancer Genetics Clinicians, 6 FAMILIAL CANCER 265,

266-68 (2007); Martin Letendre & B3atrice Godard, Expanding the Physician's Duty of Care: ADuty to Recontact?, 23 MED. L. 531, 532, 534 (2004).


As electronic patient notification becomes an accepted practice,standard messages are likely to be produced by trusted entities, suchas professional associations and experts charged with updating the

clinical decision support features of EHRs used by physicians. Theactual process could involve an expedited consensus meeting of

experts and the drafting of the message by experts in healthcommunication, with input from patient advocates on language andfollow-up strategies. Using standard electronic messages will relieveindividual physicians of much of the responsibility in analyzing new

discoveries and writing messages for patients.

C. Practical Concerns

Electronic patient notification must strive to avoid causingneedless fear, confusion, or information overload. 193 Althoughinformation overload is related to a lack of health literacy,194 it ismore complicated and also may affect individuals considered to

possess a high level of health literacy. The ability to understandhealth information also varies widely based on such demographicfactors as age, education, language proficiency, and health status. 195

An important concern is that too frequent notification orincomprehensible messages will cause patients to experience

193 See Kyunghye Kim, et al., Predictors of Cancer Information Overload: Findings from a National

Survey, 12 INFO. RES. Paper 326 (Oct. 2007), http://students.Iti.cs.cmu.edu/11899/files/

cp3a-readingwl-cancerarticle.pdf (citing NATIONAL CANCER INSTITUTE, HEALTH

INFORMATION NATIONAL TRENDS SURVEY FINAL REPORT (2003), http:/Ihints.cancer.gov/

docs/hints-report.pdf (finding that 37.7% of the 6,369 persons surveyed found the cancerinformation in their last search as hard to understand)); see also Thomas D. Wilson,Information Overload: Implications for Health Care Services, 7 HEALTH INFORMATICSJ. 112, 113

(2001) (finding technological advances have increased the amount of information available,which decreases the natural selection process of publishing only the most importantinformation).

194 Health literacy is defined as "[tihe degree to which individuals have the capacity to obtain,

process, and understand, basic health information and services needed to make appropriatehealth decisions." U.S. DEP'T OF HEALTH & HUMAN SERV., OFFICE OF DISEASE PREVENTION

AND HEALTH PROMOTION, NATIONAL ACTION PLAN TO IMPROVE HEALTH LITERACY iii (2010),

available at http://health.gov/communication/hlactionplan/pdf/healthjliteracy-action_plan.pdf (last visited Feb 24, 2012).

195 See COMM. ON HEALTH LITERACY, INSTITUTE OF MEDICINE, HEALTH LITERACY: A PRESCRIPTION

TO END CONFUSION 23, 24 (2004); see also NAT'L CENTER FOR EDUC. STATISTICS, U.S. DEP'T OF

EDUC., THE HEALTH LITERACY OF AMERICA'S ADULTS: RESULTS FROM THE 2003 NATIONAL

ASSESSMENT OF ADULT LITERACY v (2006).


needless anxiety or to regard the notice as unimportant and thereforeto ignore the information. Consequently, discretion is needed insending notices only when demonstrably necessary, in making itstandard practice to follow-up with patients about the notice at theirnext scheduled appointment, and in ensuring that notices not becombined with any other information. Patients should not viewexceptional, crucial, medical update notices as spam, advertising, orroutine health promotion communications. Finally, it is essential toincorporate quality control measures in notification systems and toundertake ongoing studies on the efficacy and outcomes associatedwith notification.

Another concern involves privacy. Many individuals useemployer-provided e-mail or shared accounts, and thus theirnotification might be sent to a computer or mobile device withoutadequate security or expressly viewable by other individuals. Whenphysicians ask patients about their notification preferences andinstructions, patients should be reminded of the potentially sensitivenature of physician-generated e-mail and other electroniccommunications. Encrypting the messages could help protectsecurity, but it would be feasible only if patients had the ability toreceive and decipher encrypted messages.

VIII. CONCLUSION

The development, adoption, and utilization of HIT are works inprogress - and will remain so for the foreseeable future. Thechallenges for HIT policy makers and health care leaders go beyondresolving technological glitches and maximizing return oninvestment; they involve formulating a vision of the role of healthinformation in the health care system of the future. With stringentprotections for privacy, confidentiality, and security, an increasedflow of health information can facilitate coordinated, safe, andeffective health care as well as support outcomes, public health, andother research.

Many optimistic and positive terms have been used to describethe EHRs and EHR networks of the future, including "accurate,""timely," "comprehensive," "longitudinal," and "interoperable." The


term "bi-directional" should be added to this list. Valuable healthinformation needs to flow not only from the patient, but also to thepatient. Additional medical information developed after the patient'sepisode of care and shared with the patient will enable patients andtheir caregivers to play a more informed and meaningful role inhealth management. HIT makes this vision of informationdissemination a realistic goal and an essential component of theemerging health care system.

The bi-directional flow of information has important implicationsfor the physician-patient relationship,196 and these issues ought to beaddressed concurrently with the technological challenges. In theextraordinary situations described in this article, physicians shouldhave a legal and ethical duty to notify patients of significant newmedical developments of demonstrable utility to patient health. Thisduty should become an explicit element of medical codes of ethicsand, where the duty is breached and harm results, there should be acommon law cause of action.

The duty proposed in this article is intended to promote the wellbeing of patients. Compliance with the duty is technically feasiblewith existing and developing HIT, and increasing consolidation ofphysician practices and hospitals will make it easier to sendnecessary updates to patients from a central source. Patientnotification obligations are compatible with the coordination of careobjectives of accountable care organizations, medical homes, andother elements of the emerging health care system. Patientnotification is also consistent with already-recognized ethicalprinciples. It parallels statutory duties of health care providers toshare important information with patients, and it is consonant withrecognized common law doctrines. Some practical issues remain tobe resolved, such as deciding which patients should be notified andhow notification should take place, but these problems aresurmountable and should be addressed promptly. The substantialbenefits of patient notification of new medical discoveries provide animportant rationale for the expeditious adoption of HIT by health

196 See Mark A. Rothstein, The Hippocratic Bargain and Health Information Technology, 38 J.L.

MED. & ETHICS 7, 11 (2010) (discussing the effect of health information technology on thephysician-patient relationship).


care providers.

Documents

(,1 2 1/,1( - University of Virginia School of Law · rofecoxib (Vioxx®), a nonsteroidal anti-inflammatory drug, by its manufacturer, Merck & Co., Inc.13 A large study had indicated